daemon: Reject non-link-local addresses passed as link-local IPs

The daemon only checked that each address in
EndpointIPAMConfig.LinkLocalIPs was a valid, specified address.
Whether it was actually link-local was only checked by libnetwork when
it created the endpoint. So creating a container, or connecting a
stopped container, with for example "--link-local-ip 10.0.0.5"
succeeded, and the error only appeared when the container was started.

Validation now requires link-local unicast addresses (169.254.0.0/16,
fe80::/10), so container create and network connect reject addresses
outside those ranges before changing container state.
The accepted ranges match libnetwork's existing checks.

Validation also rejects addresses with zones, such as fe80::1%eth0.
These were previously accepted, but endpoint creation silently discarded
the zone when converting the address to bytes.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

daemon/container_operations.go

@@ -601,7 +601,7 @@ func normalizeEndpointIPAMConfig(errs []error, cfg *networktypes.EndpointIPAMCon
 		}
 	}
 	for _, addr := range cfg.LinkLocalIPs {
-		if !addr.IsValid() || addr.IsUnspecified() {
+		if !addr.IsLinkLocalUnicast() || addr.Zone() != "" {
 			errs = append(errs, fmt.Errorf("invalid link-local IP address: %s", addr))
 		}
 	}

daemon/container_operations_test.go

@@ -180,6 +180,27 @@ func TestEndpointIPAMConfigWithInvalidConfig(t *testing.T) {
 			},
 			expectedErrors: []string{"invalid link-local IP address:"},
 		},
+		{
+			name: "non-link-local IPv4 address as link-local",
+			ipamConfig: &networktypes.EndpointIPAMConfig{
+				LinkLocalIPs: []netip.Addr{netip.MustParseAddr("10.0.0.5")},
+			},
+			expectedErrors: []string{"invalid link-local IP address: 10.0.0.5"},
+		},
+		{
+			name: "non-link-local IPv6 address as link-local",
+			ipamConfig: &networktypes.EndpointIPAMConfig{
+				LinkLocalIPs: []netip.Addr{netip.MustParseAddr("2001:db8::1")},
+			},
+			expectedErrors: []string{"invalid link-local IP address: 2001:db8::1"},
+		},
+		{
+			name: "link-local address with a zone",
+			ipamConfig: &networktypes.EndpointIPAMConfig{
+				LinkLocalIPs: []netip.Addr{netip.MustParseAddr("fe80::1%eth0")},
+			},
+			expectedErrors: []string{"invalid link-local IP address: fe80::1%eth0"},
+		},
 	}
 
 	for _, tc := range tests {